1#         @(#)CHANGES         5.1 (Berkeley) 5/11/93
2
3This new version is almost identical to the timed and timedc code
4that has been shipped for years by a workstation vendor.
5
6Among the many changes:
7
8improve `timedc msite` to accept a list of hostnames.
9
10change slave-masters to answer the packets generated by `timedc msite`
11    with the name of the real master, not their own.  This makes it
12    possible to "chase the chain" of slave servers to the ultimate
13    master.
14
15much improve the log caused by `timedc trace on`:
16    -made `timed -t` work.
17    -suppression of repeated entries, which both slowed down the daemon
18          (sometimes catastrophically) and tended to make disks fill up
19          even more quickly.
20    -better time stamps on log entries
21    -more messages
22    -dump information about slaves, master, and so on each time
23          a message asking the log be turned on is received, and
24          when the log is turned off.
25    -fewer CPU cycles
26
27use a hash table to keep track of slaves, instead of the stupid linear
28    list.  This becomes handy with hundreds of slaves, instead of
29    the original design limit of "a room with a few VAX's."
30
31separate the main protocol timer from that used to look for other networks
32    to master.
33
34time stamp packets received by the daemon, so that time corrections
35    are not made (even more) inaccurate by waiting in the internal,
36    timed queue while the daemon is processing other messages.
37
38made -n and -i work with subnets not named in /etc/networks
39
40compute the median of the measured clocks, instead of the average
41    of "good" times.
42
43vastly improve the accuracy of the clock difference measure by
44    `timedc clockdiff`.
45
46use adjtime() when possible, and directly set the clock only when
47    necessary.
48
49when the requested adjustment is small, perform only part of it, to
50    damp oscillations and improve the long term accuracy of the
51    adjustments.
52
53fix uncounted core-dumps on machines that do not allow dereferencing 0
54    in both the daemon and timedc.
55
56fix "master loop detection".
57
58fix several cases in which multi-homed masters could get into shouting
59    matches, consuming all available network bandwidth and CPU cycles
60    (which ever runs out first), and convincing all bystanders to stop
61    advancing their own clocks.
62
63refuse to behave badly when other machines do.  Instead of arguing forever,
64    go off and sulk when other machines refuse to play by the rules.
65
66increase the maximum number of clients.
67
68add "-F host,host2,..." to "freerun" or "trust" only some hosts.  This
69    is handy both when only some machines should be trusted to let
70    root use the `date` command to change time in the network.
71
72    It is also handy when one machine has some other way of adjusting
73    its clock, whether NTP or a direct radio or atomic connection.
74    "-F localhost" causes `timed` to "trust" only itself.
75
76    It is also handy to build a hierarchy of timed masters crossing
77    networks.  The TSP protocol has no provision of "goodness of clock",
78    no natural way to completely heal network partitions.  Judicious
79    use of -F or -G can cause each gateway to trust only itself and
80    machines closer to a central machine with a radio or atomic clock.
81
82add #ifdef code that supports NIS "netgroups" of trusted hosts, which
83    can be easier to administer than -F.
84
85add #ifdef code to compute an aged total adjustment.  This can be used
86    in systems that can make long term changes in their system clock
87    frequency, e.g. "timetrim" in the Silicon Graphics kernel.
88
89
90Problems observed by others that are unresolved include:
91
92Practically any users can send to the master TSP messages and this
93          way corrupt the reliability of the system.  Authentication
94          of messages should be provided.  Unfortunately, that would
95          require changing the protocol with all of the implied
96          compatibility problems.  Fortunately, the new -F and -G args
97          can be used to cause the daemon to ignore time changes from
98          untrusted machines.
99
100MAN.      The limit of 1013 on the number of slaves hosts should be doc'ed.
101
102          It should be dynamically allocated with no limit.  On a
103          large network, one host could possibly master over many
104          more than 30 hosts.   Given the timers in the code and
105          effectively in the protocol, and the time required by each
106          master to talk to each slave, it is not practical to have
107          more than 200-300 slaves.  The master cannot keep up because
108          the slave-chatting is single-threaded.  when the master
109          gets behind, slaves start demanding elections.  To
110          significantly increase the number of slaves would require
111          multi-treading things, and given that a network with more
112          than 300 directly addressable machines has worse problems
113          than keep the time of day right, not worth worrying about.
114
115UGLY,CODE. timedc/cmds.c has a lots of repeated code in it.
116
117****    The first thing is that each command is set up as if it
118          were an individual program taking argc and argv.  A more
119          conventional calling style should be used.  I don't think
120          any of the routines take more than a couple arguments.
121
122UGLY.     fxn definition syntax does't follow convention:
123          has type on same line.
124
125****      It needs to be fixed at least enough that tags
126          will work on it.  An entire cleanup might be nice later, but
127          is noncritical.
128
129LOBBY(mildly),CODE: Would be very convenient if date(1) took a
130          +-<number> argument to set the time relatively.  With
131          the advent of timed it is now reasonable to synchronize
132          with WWV, which is nearly impossible to do "by hand"
133          with just an absolute date, and scripts are too slow.
134          format could be +-nn...nn.ss, where the '.' is required
135          to remove ambiguity.
136
137****      If you want to do it go ahead.  It sounds useful.  As far as
138          syntax goes, the normal format for the date should work just
139          fine for this.  If the date is preceded by a plus or minus,
140          the change is relative, otherwise it is absolute.
141
142
143Vernon Schryver.
144vjs@sgi.com
145